“Sqrrl 2.8 is all about better threat hunting and faster investigations,” said Sqrrl CEO Mark Terenzoni. “This new version arms analysts with the analytic and risk tools they need to detect and investigate advanced threats more efficiently, effectively, and proactively.”

Today, analysts must either have advanced data science skills to build hunting algorithms that detect suspicious cyber behaviors or rely on blackbox vendor tools that package rigid algorithms. Version 2.8 of Sqrrl’s Threat Hunting Platform introduces the ability for analysts to easily create new hunting analytics without writing any code or having any data science skills. These analyst-defined analytics are referred to as “Risk Triggers.”

“The best threat hunters accelerate hunts by focusing on the relationships between alerts, threat intelligence, and data points, “ says Eric Ogren, senior security analyst at 451 Research. “It is essential to be able to evaluate risky behavior while hunting threats – a key feature of Risk Triggers. Not only does this accelerate their hunts, it makes it easy for hunters to experiment and get the most value out of their data.” he said.

In addition to Risk Triggers, the release of Sqrrl 2.8 includes an extensible risk framework, risk timelining capability and a number of supporting platform features that simplify Sqrrl’s unique form of link analysis across key security data sources. These features are described below.

Analyst-Defined Threat Hunting Analytics

Sqrrl’s new Risk Trigger framework enables the easy creation of custom-built threat hunting analytics. Risk Triggers use Sqrrl’s graph query syntax to automatically find patterns, and analysts can integrate advanced anomaly detection capabilities into the triggers without having to write any code. Analysts can create Risk Triggers to do such actions as detect threat intelligence matches, identify abnormal user or asset activity, and uncover suspicious connections between entities.

Extensible Risk Framework and Risk Timelining

With Sqrrl’s new extensible risk framework, Sqrrl provides a comprehensive view of risky activity across the organization. Using Risk Triggers, Sqrrl can calculate risk scores on every user, IP address, host, and domain inside the organization by fusing together Sqrrl’s analytics with external sources of risk such as SIEM alerts, threat intelligence, and vulnerability scans. Risky activity is now displayed as a timeline on each user, asset, and entity to provide analysts with a view of how risk and security postures are evolving over time.

Other Key Features:

Streamlined Link Analysis: The enhanced interface makes it much easier for analysts to pivot through data, build attack narratives more quickly, and enables more junior analysts to take on advanced hunting.

Simplified Graph Data Extraction: Improvements to the backend of Sqrrl’s Security Behavior Graph, enable security architects to more easily extract the most important fields needed for hunting from incoming data feeds and automatically fuse those fields into hunting data models. This enables organizations to integrate new datasets more quickly and spend more time on hunting and less time on data modeling.

About Article Author

Jonathan Yaniv

Jonathan is the founder and editor-in-chief of TrustedNerd.com. Covering major tech shows such as CES, Jonathan is always there for the latest tech news. Want your gadget to be reviewed or have a release you’d like to be considered for publishing? Send Jonathan an email, jonathan [at] trustednerd.com